CVE-2025-59236: Microsoft 365 Apps Use-After-Free Flaw

CVE-2025-59236 Overview

CVE-2025-59236 is a use-after-free vulnerability [CWE-416] in Microsoft Office Excel that allows an unauthorized local attacker to execute code on the target system. The flaw affects multiple supported Office builds, including Microsoft 365 Apps, Office 2019, and Office Long Term Servicing Channel (LTSC) 2021 and 2024 on both Windows and macOS, as well as Office Online Server. Successful exploitation requires user interaction with a crafted Excel document and results in code execution in the context of the current user. Microsoft assigned a CVSS 3.1 base score of 7.8 and released a security update through the Microsoft Security Response Center (MSRC).

Critical Impact
A crafted Excel file can trigger a use-after-free condition, enabling arbitrary code execution with the privileges of the user opening the document.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2019 (x64 and x86)
Microsoft Office LTSC 2021 and 2024 (Windows x64/x86 and macOS)
Microsoft Office Online Server

Discovery Timeline

2025-10-14 - CVE-2025-59236 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59236

Vulnerability Analysis

CVE-2025-59236 is a use-after-free defect in Microsoft Excel's document processing logic. Use-after-free issues occur when application code continues to reference memory that has already been released back to the allocator. An attacker who controls the freed object's layout can groom the heap and place attacker-influenced data at that address. When Excel later dereferences the stale pointer, execution can be redirected into attacker-controlled memory. Because the vulnerability resides in a widely deployed productivity application, it presents a practical initial access and post-compromise execution primitive for phishing and targeted document delivery.

Root Cause

The issue is classified under CWE-416: Use After Free. Excel frees an internal object while another code path retains a reference to it. Subsequent operations on the dangling reference operate on memory that may have been reallocated for a different purpose, producing memory corruption. Microsoft has not publicly disclosed the specific Excel component or object type responsible for the condition.

Attack Vector

Exploitation is local and requires the victim to open a specially crafted Excel workbook. The attack vector is typically email-borne phishing, malicious file shares, or drive-by download of a spreadsheet. No elevated privileges are required beyond those of the current user, and no additional user interaction beyond opening the file is needed once the document is loaded. Code executes in the security context of the Excel process, which can then be used for credential access, lateral movement, or persistence.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update CVE-2025-59236 advisory for vendor technical details.

Detection Methods for CVE-2025-59236

Indicators of Compromise

Unexpected Excel (EXCEL.EXE) child processes such as cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, or wscript.exe
Excel process crashes with access-violation exceptions when opening .xls, .xlsx, .xlsm, or .xlsb files from untrusted sources
Outbound network connections initiated directly from EXCEL.EXE to previously unseen hosts shortly after a file is opened
Newly written executables or scripts in %TEMP%, %APPDATA%, or %PUBLIC% following spreadsheet access

Detection Strategies

Hunt for anomalous parent-child process relationships where Office applications spawn command interpreters or scripting hosts
Correlate Windows Error Reporting entries for Excel with subsequent process creation and file-write activity on the same host
Inspect inbound email attachments and cloud storage uploads containing Excel workbooks with embedded external references or unusual OLE streams

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and writing executable content
Forward Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) from user endpoints to a central analytics platform
Alert on Office telemetry indicating protected view bypass or macro execution outside approved trust locations

How to Mitigate CVE-2025-59236

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-59236 across all Office installations
Prioritize patching for users who routinely handle spreadsheets from external senders, including finance, procurement, and executive assistants
Verify update deployment status for Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024 on both Windows and macOS
Enforce that Office Online Server instances are patched to the fixed build

Patch Information

Microsoft published the fix through its standard update channels. For Microsoft 365 Apps, updates are delivered via Click-to-Run. For perpetual Office 2019 and LTSC 2021/2024, security updates are distributed through Microsoft Update, WSUS, and the Microsoft Update Catalog. Refer to the Microsoft Security Update CVE-2025-59236 advisory for exact build numbers per channel and platform.

Workarounds

Enforce Protected View for files originating from the internet, email attachments, and unsafe locations
Disable macros by default and require digital signatures for any workbook containing VBA code
Use Group Policy or Intune to block Office applications from creating executable child processes
Apply Mark-of-the-Web (MOTW) preservation on downloaded files so Excel enforces its restricted execution mode

bash

# Example Group Policy registry keys to enforce Protected View for Excel
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f

# Block macros from files originating from the internet
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f